###############################################################################
#
# Sheriff53 blocklist
#
# > Contribute:
# Create an issue at https://notabug.org/phronimon/sheriff53blocklists/issues
#
# > License:
# To the extent possible under law, the person who associated CC0 with
# Sheriff53 has waived all copyright and related or neighboring rights
# to Sheriff53.
#
# You should have received a copy of the CC0 legalcode along with this
# work. If not, see <http://creativecommons.org/publicdomain/zero/1.0/>.
#
# > Category: Malware
#
# - Command and Control (C&C)
# - Malware-as-a-Service (MaaS)
# - IP-Loggers
# - URL hijacking (Typosquatting)
# - IDN Homograph Attack
#
###############################################################################
# https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
avsvmcloud.com
#appsync-api.eu-west-1.avsvmcloud.com
#appsync-api.us-west-2.avsvmcloud.com
#appsync-api.us-east-1.avsvmcloud.com
#appsync-api.us-east-2.avsvmcloud.com
# https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed
browserupdate.download
#flash.browserupdate.download
#current.browserupdate.download
#files.browserupdate.download
# https://www.amnesty.org/en/latest/research/2018/08/amnesty-international-among-targets-of-nso-powered-campaign
banca-movil.com
pine-sales.com
ecommerce-ads.org
ticket-selections.com
bytlo.com
# https://github.com/AmnestyTech/investigations/blob/master/2018-08-01_nso/indicators.csv TODO
# https://www.forbes.com/sites/thomasbrewster/2019/07/10/25-million-android-phones-infected-with-malware-that-hides-in-whatsapp/#4a9607a4470e
9apps.com
# https://www.proofpoint.com/us/blog/threat-insight/ta413-leverages-new-friarfox-browser-extension-target-gmail-accounts-global
you-tube.tv
vaccine-icmr.net
indiatrustdalailama.com
nangsihistory.vip
# https://research.checkpoint.com/2021/clast82-a-new-dropper-on-google-play-dropping-the-alienbot-banker-and-mrat
boloklava87.club
enegal-23.net
balabanga90.online
dsfikj2dsfmolds.top
blakarda.site
sponkisn.site
# https://blog.zimperium.com/new-advanced-android-malware-posing-as-system-update
mypro-b3435.firebaseio.com
licences.website
# https://blog.confiant.com/tag-barnakle-one-year-later-120-more-revive-adserver-hacks-f3e5b3bc8e70
ads.a2epub.com
ads.fakulteti.mk
ads.latinongroup.com
ads.mygc.com.au
ads.performanceracing.com
ads.tcsemotion.com
ads.veterinaren.nu
ads2.focus-news.net
asianmedia.com
engagement.sandesh.com
england365.gr
mtrck.info
p.posventa.info
ac24horas.com
ad.aniu.tv
ad.investmap.pl
ad.mds.lv
ad.zfk.de
admanager.uptodown.com
ads.4x4brasil.com.br
ads.adsolut.in
ads.baotainguyenmoitruong.vn
ads.catmedia.cat
ads.citymagazine.rs
ads.ck101.com
ads.d3corp.com
ads.diariodehuelva.es
ads.directa.cat
ads.easyodds.com
ads.ejz.de
ads.elperiodic.ad
ads.eltemps.cat
ads.femmexpat.net
ads.gogovest.com
ads.inselradio.com
ads.kafepauza.mk
ads.khoahocdoisong.vn
ads.motorgraph.com
ads.newsbook.com.mt
ads.press24.mk
ads.republica.com.uy
ads.samartdigitalmedia.com
ads.shasha.ps
ads.tirabol.cat
ads.tuniscope.com
ads.tvh.no
ads.uh.ro
ads.urgente24.com
ads.warrelics.eu
ads.zilesinopti.ro
ads1.knxs.net
ads2.epsilonnet.gr
ads2.jenite.bg
ads5.matichon.co.th
adserv.emh.ch
adserver.automobilwoche.de
adserver.desnivel.com
adserver.diariodosertao.com.br
adserver.greeners.co
adserver.krankenkassennetz.de
adserver.lasiciliaweb.it
adserver.lenouvelliste.com
adserver.logisticaprofesional.com
adserver.maispb.com.br
adserver.nearby.cz
adserver.polemicaparaiba.com.br
adserver.wolterskluwer.pl
adserverhd.com
adstdg.net
adv2.grupopreferente.com
adx.ephoto.sk
artduomo.es
asap.sindikata.org
ba1.groupgti.com
banner.bauernverlag.de
banners.evoluhcion.es
comercial.megafin.pt
d.otaserve.net
ittnads.advantagegroup.ie
kampane.virtualstudio.sk
lakewoodmediagroup.net
leadz01.isn.nl
miranda.bounced.de
murciaeconomia.folioserver.com
ngex.com
openx.jawharafm.net
openx.mediatrust.de
openx.mondiale.co.uk
ox.ghanasoccernet.com
pub.macommune.info
pub.naiz.eus
pubs2.latinspots.com
reklama.silnet.pl
rev.contractoruk.com
revive.agenda.ge
revive.bdnews24.com
revive.saechsische-schweiz.de
revive.theaterkrant.nl
revive.thebusinessjournal.com
revive.unizo.be
row.volksstimme.de
sbplus.hr
services.albiladpress.com
skyrisecities.com
ssp.putaojiu.com
theleader.info
treehouse.wwoz.org
urbantoronto.ca
visualise.click
wer.schwarzwaelder-bote.de
4x4brasil.com.br
actuabd.com
bioverlag-online.de
drumcorpsplanet.com
ecofinads.com
manga-news.com
miciudadreal.es
pivata.net
porovname.cz
rcommunications.com
styledrops.hu
webkamery-krkonose.cz
convergenciadigital.com.br
# IOCs - Tag Barnakle Fingerprinting Domains
tucanastar.com
topwindstar.com
line2lime.com
adbigline.network
reticulumlyn.com
bibugal.network
hoshiwa.com
wetral.com
galikos.com
# https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus
msstore.io
adtracker.link
cdnmobile.io
# https://threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html
protectionguardapp.club
readyqrscanner.club
flowdivison.club
multifuctionscanner.club
onlinefitnessanalysis.com
grabify.link
# https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware
cytrox.com
distedc.com
gosokm.com
youtubesyncapi.com
bity.ws
egyqaz.com
almasryelyuom.com
qwxzyl.com
yuom7.net
youtu-be.net
aramexegypt.com
alraeesnews.net
bank-alahly.com
carrefourmisr.com
eg-gov.org
etisalategypt.tech
ikea-egypt.net
orangegypt.co
sinai-new.com
uberegypt.cn.com
vodafoneegypt.tech
yallakora-egy.com
adibjan.net
politique-koaci.info
tribune-mg.xyz
actumali.org
niceonase.com
niceonesa.net
novosti.bid
politika.bid
forwardeshoptt.com
guardian-tt.me
applepps.com
ffoxnewz.com
playestore.net
instegram.co
lnkedin.org
sephoragroup.com
teslal.shop
teslal.xyz
twtter.net
youtub.app
itter.me
tsapp.me
xnxx-hub.com
youtubewatch.co
# END #########################################################################

